logstash-filter-dns 3.0.3 → 3.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile +8 -1
- data/docs/index.asciidoc +161 -0
- data/lib/logstash/filters/dns.rb +3 -3
- data/logstash-filter-dns.gemspec +2 -2
- metadata +4 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 2588795adf083d4812dc3c59973afd5109e97f78
|
4
|
+
data.tar.gz: 129c2b1c78212afb83dc0a76ea52072e62b31639
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 4a440cdd51ec786800ff5d387f82dcbe0359832db7ea7ec3bed9323e1ffae7495516e684f15e32e9ac2c943715b89cef754c17aa94cc5563f93f1a32e590f59f
|
7
|
+
data.tar.gz: ae8c839ce54b097491394a4383e77c6a6afd18ee38c69c178374ca9b0e1a20d1a3288fd3f00d750b0c9d61b2d17290569a3ec87dde443e1a4187b8cf17e19863
|
data/Gemfile
CHANGED
@@ -1,4 +1,11 @@
|
|
1
1
|
source 'https://rubygems.org'
|
2
2
|
|
3
|
-
# Specify your gem's dependencies in logstash-mass_effect.gemspec
|
4
3
|
gemspec
|
4
|
+
|
5
|
+
logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
|
6
|
+
use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
|
7
|
+
|
8
|
+
if Dir.exist?(logstash_path) && use_logstash_source
|
9
|
+
gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
|
10
|
+
gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
|
11
|
+
end
|
data/docs/index.asciidoc
ADDED
@@ -0,0 +1,161 @@
|
|
1
|
+
:plugin: dns
|
2
|
+
:type: filter
|
3
|
+
|
4
|
+
///////////////////////////////////////////
|
5
|
+
START - GENERATED VARIABLES, DO NOT EDIT!
|
6
|
+
///////////////////////////////////////////
|
7
|
+
:version: %VERSION%
|
8
|
+
:release_date: %RELEASE_DATE%
|
9
|
+
:changelog_url: %CHANGELOG_URL%
|
10
|
+
:include_path: ../../../../logstash/docs/include
|
11
|
+
///////////////////////////////////////////
|
12
|
+
END - GENERATED VARIABLES, DO NOT EDIT!
|
13
|
+
///////////////////////////////////////////
|
14
|
+
|
15
|
+
[id="plugins-{type}-{plugin}"]
|
16
|
+
|
17
|
+
=== Dns filter plugin
|
18
|
+
|
19
|
+
include::{include_path}/plugin_header.asciidoc[]
|
20
|
+
|
21
|
+
==== Description
|
22
|
+
|
23
|
+
The DNS filter performs a lookup (either an A record/CNAME record lookup
|
24
|
+
or a reverse lookup at the PTR record) on records specified under the
|
25
|
+
`reverse` arrays or respectively under the `resolve` arrays.
|
26
|
+
|
27
|
+
The config should look like this:
|
28
|
+
[source,ruby]
|
29
|
+
filter {
|
30
|
+
dns {
|
31
|
+
reverse => [ "source_host", "field_with_address" ]
|
32
|
+
resolve => [ "field_with_fqdn" ]
|
33
|
+
action => "replace"
|
34
|
+
}
|
35
|
+
}
|
36
|
+
|
37
|
+
This filter, like all filters, only processes 1 event at a time, so the use
|
38
|
+
of this plugin can significantly slow down your pipeline's throughput if you
|
39
|
+
have a high latency network. By way of example, if each DNS lookup takes 2
|
40
|
+
milliseconds, the maximum throughput you can achieve with a single filter
|
41
|
+
worker is 500 events per second (1000 milliseconds / 2 milliseconds).
|
42
|
+
|
43
|
+
[id="plugins-{type}s-{plugin}-options"]
|
44
|
+
==== Dns Filter Configuration Options
|
45
|
+
|
46
|
+
This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
|
47
|
+
|
48
|
+
[cols="<,<,<",options="header",]
|
49
|
+
|=======================================================================
|
50
|
+
|Setting |Input type|Required
|
51
|
+
| <<plugins-{type}s-{plugin}-action>> |<<string,string>>, one of `["append", "replace"]`|No
|
52
|
+
| <<plugins-{type}s-{plugin}-failed_cache_size>> |<<number,number>>|No
|
53
|
+
| <<plugins-{type}s-{plugin}-failed_cache_ttl>> |<<number,number>>|No
|
54
|
+
| <<plugins-{type}s-{plugin}-hit_cache_size>> |<<number,number>>|No
|
55
|
+
| <<plugins-{type}s-{plugin}-hit_cache_ttl>> |<<number,number>>|No
|
56
|
+
| <<plugins-{type}s-{plugin}-hostsfile>> |<<array,array>>|No
|
57
|
+
| <<plugins-{type}s-{plugin}-max_retries>> |<<number,number>>|No
|
58
|
+
| <<plugins-{type}s-{plugin}-nameserver>> |<<array,array>>|No
|
59
|
+
| <<plugins-{type}s-{plugin}-resolve>> |<<array,array>>|No
|
60
|
+
| <<plugins-{type}s-{plugin}-reverse>> |<<array,array>>|No
|
61
|
+
| <<plugins-{type}s-{plugin}-timeout>> |<<number,number>>|No
|
62
|
+
|=======================================================================
|
63
|
+
|
64
|
+
Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
|
65
|
+
filter plugins.
|
66
|
+
|
67
|
+
|
68
|
+
|
69
|
+
[id="plugins-{type}s-{plugin}-action"]
|
70
|
+
===== `action`
|
71
|
+
|
72
|
+
* Value can be any of: `append`, `replace`
|
73
|
+
* Default value is `"append"`
|
74
|
+
|
75
|
+
Determine what action to do: append or replace the values in the fields
|
76
|
+
specified under `reverse` and `resolve`.
|
77
|
+
|
78
|
+
[id="plugins-{type}s-{plugin}-failed_cache_size"]
|
79
|
+
===== `failed_cache_size`
|
80
|
+
|
81
|
+
* Value type is <<number,number>>
|
82
|
+
* Default value is `0`
|
83
|
+
|
84
|
+
cache size for failed requests
|
85
|
+
|
86
|
+
[id="plugins-{type}s-{plugin}-failed_cache_ttl"]
|
87
|
+
===== `failed_cache_ttl`
|
88
|
+
|
89
|
+
* Value type is <<number,number>>
|
90
|
+
* Default value is `5`
|
91
|
+
|
92
|
+
how long to cache failed requests (in seconds)
|
93
|
+
|
94
|
+
[id="plugins-{type}s-{plugin}-hit_cache_size"]
|
95
|
+
===== `hit_cache_size`
|
96
|
+
|
97
|
+
* Value type is <<number,number>>
|
98
|
+
* Default value is `0`
|
99
|
+
|
100
|
+
set the size of cache for successful requests
|
101
|
+
|
102
|
+
[id="plugins-{type}s-{plugin}-hit_cache_ttl"]
|
103
|
+
===== `hit_cache_ttl`
|
104
|
+
|
105
|
+
* Value type is <<number,number>>
|
106
|
+
* Default value is `60`
|
107
|
+
|
108
|
+
how long to cache successful requests (in seconds)
|
109
|
+
|
110
|
+
[id="plugins-{type}s-{plugin}-hostsfile"]
|
111
|
+
===== `hostsfile`
|
112
|
+
|
113
|
+
* Value type is <<array,array>>
|
114
|
+
* There is no default value for this setting.
|
115
|
+
|
116
|
+
Use custom hosts file(s). For example: `["/var/db/my_custom_hosts"]`
|
117
|
+
|
118
|
+
[id="plugins-{type}s-{plugin}-max_retries"]
|
119
|
+
===== `max_retries`
|
120
|
+
|
121
|
+
* Value type is <<number,number>>
|
122
|
+
* Default value is `2`
|
123
|
+
|
124
|
+
number of times to retry a failed resolve/reverse
|
125
|
+
|
126
|
+
[id="plugins-{type}s-{plugin}-nameserver"]
|
127
|
+
===== `nameserver`
|
128
|
+
|
129
|
+
* Value type is <<array,array>>
|
130
|
+
* There is no default value for this setting.
|
131
|
+
|
132
|
+
Use custom nameserver(s). For example: `["8.8.8.8", "8.8.4.4"]`
|
133
|
+
|
134
|
+
[id="plugins-{type}s-{plugin}-resolve"]
|
135
|
+
===== `resolve`
|
136
|
+
|
137
|
+
* Value type is <<array,array>>
|
138
|
+
* There is no default value for this setting.
|
139
|
+
|
140
|
+
Forward resolve one or more fields.
|
141
|
+
|
142
|
+
[id="plugins-{type}s-{plugin}-reverse"]
|
143
|
+
===== `reverse`
|
144
|
+
|
145
|
+
* Value type is <<array,array>>
|
146
|
+
* There is no default value for this setting.
|
147
|
+
|
148
|
+
Reverse resolve one or more fields.
|
149
|
+
|
150
|
+
[id="plugins-{type}s-{plugin}-timeout"]
|
151
|
+
===== `timeout`
|
152
|
+
|
153
|
+
* Value type is <<number,number>>
|
154
|
+
* Default value is `0.5`
|
155
|
+
|
156
|
+
`resolv` calls will be wrapped in a timeout instance
|
157
|
+
|
158
|
+
|
159
|
+
|
160
|
+
[id="plugins-{type}s-{plugin}-common-options"]
|
161
|
+
include::{include_path}/{type}.asciidoc[]
|
data/lib/logstash/filters/dns.rb
CHANGED
@@ -60,7 +60,7 @@ class LogStash::Filters::DNS < LogStash::Filters::Base
|
|
60
60
|
# how long to cache successful requests (in seconds)
|
61
61
|
config :hit_cache_ttl, :validate => :number, :default => 60
|
62
62
|
|
63
|
-
# cache size for failed requests
|
63
|
+
# cache size for failed requests
|
64
64
|
config :failed_cache_size, :validate => :number, :default => 0
|
65
65
|
|
66
66
|
# how long to cache failed requests (in seconds)
|
@@ -78,11 +78,11 @@ class LogStash::Filters::DNS < LogStash::Filters::Base
|
|
78
78
|
end
|
79
79
|
|
80
80
|
if @hit_cache_size > 0
|
81
|
-
@hit_cache = LruRedux::ThreadSafeCache.new(@hit_cache_size, @hit_cache_ttl)
|
81
|
+
@hit_cache = LruRedux::TTL::ThreadSafeCache.new(@hit_cache_size, @hit_cache_ttl)
|
82
82
|
end
|
83
83
|
|
84
84
|
if @failed_cache_size > 0
|
85
|
-
@failed_cache = LruRedux::ThreadSafeCache.new(@failed_cache_size, @failed_cache_ttl)
|
85
|
+
@failed_cache = LruRedux::TTL::ThreadSafeCache.new(@failed_cache_size, @failed_cache_ttl)
|
86
86
|
end
|
87
87
|
|
88
88
|
@ip_validator = Resolv::AddressRegex
|
data/logstash-filter-dns.gemspec
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-dns'
|
4
|
-
s.version = '3.0.
|
4
|
+
s.version = '3.0.4'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter will resolve any IP addresses from a field of your choosing."
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
|
|
11
11
|
s.require_paths = ["lib"]
|
12
12
|
|
13
13
|
# Files
|
14
|
-
s.files = Dir[
|
14
|
+
s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
|
15
15
|
|
16
16
|
# Tests
|
17
17
|
s.test_files = s.files.grep(%r{^(test|spec|features)/})
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-dns
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 3.0.
|
4
|
+
version: 3.0.4
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2017-06-23 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
@@ -70,6 +70,7 @@ files:
|
|
70
70
|
- LICENSE
|
71
71
|
- NOTICE.TXT
|
72
72
|
- README.md
|
73
|
+
- docs/index.asciidoc
|
73
74
|
- lib/logstash/filters/dns.rb
|
74
75
|
- logstash-filter-dns.gemspec
|
75
76
|
- spec/filters/dns_spec.rb
|
@@ -96,7 +97,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
96
97
|
version: '0'
|
97
98
|
requirements: []
|
98
99
|
rubyforge_project:
|
99
|
-
rubygems_version: 2.
|
100
|
+
rubygems_version: 2.4.8
|
100
101
|
signing_key:
|
101
102
|
specification_version: 4
|
102
103
|
summary: This filter will resolve any IP addresses from a field of your choosing.
|